<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /> 
    <title> - 天地维杰网</title>
    <meta name="keywords" content="系统架构,shutdown,不与天斗,Domino,博客,程序员,架构师,笔记,技术,分享,java,Redis">
    
    <meta property="og:title" content="">
    <meta property="og:site_name" content="天地维杰网">
    <meta property="og:image" content="/img/author.jpg"> 
    <meta name="title" content=" - 天地维杰网" />
    <meta name="description" content="天地维杰网 | 博客 | 软件 | 架构 | Java "> 
    <link rel="shortcut icon" href="http://www.shutdown.cn/img/favicon.ico" />
    <link rel="apple-touch-icon" href="http://www.shutdown.cn/img/apple-touch-icon.png" />
    <link rel="apple-touch-icon-precomposed" href="http://www.shutdown.cn/img/apple-touch-icon.png" />
    <link href="http://www.shutdown.cn/js/vendor/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css" />
    <link href="http://www.shutdown.cn/js/vendor/fancybox/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css" />
    <link href="http://www.shutdown.cn/css/main.css" rel="stylesheet" type="text/css" />
    <link href="http://www.shutdown.cn/css/syntax.css" rel="stylesheet" type="text/css" />
    <script type="text/javascript" id="hexo.configuration">
  var NexT = window.NexT || {};
  var CONFIG = {
    scheme: 'Pisces',
    sidebar: {"position":"left","display":"post"},
     fancybox: true, 
    motion: true
  };
</script>
<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7826003325059020" crossorigin="anonymous"></script>
</head>
<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
<div class="container one-collumn sidebar-position-left page-home  ">
    <div class="headband"></div>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"> <div class="site-meta  custom-logo ">

  <div class="custom-logo-site-title">
    <a href="http://www.shutdown.cn"  class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <span class="site-title">天地维杰网</span>
      <span class="logo-line-after"><i></i></span>
    </a>
  </div>
  <p class="site-subtitle">人如秋鸿来有信，事若春梦了无痕</p>
</div>

<div class="site-nav-toggle">
  <button>
    <span class="btn-bar"></span>
    <span class="btn-bar"></span>
    <span class="btn-bar"></span>
  </button>
</div>

<nav class="site-nav">
    <ul id="menu" class="menu">
      
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br />首页
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/redis/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-battery-full"></i> <br />Redis
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/java/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-coffee"></i> <br />java
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/linux/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-linux"></i> <br />linux
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/daily/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-bug"></i> <br />日常问题
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/spring/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-child"></i> <br />Spring和Springboot
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/mac/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-fire"></i> <br />Mac相关
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/middleware/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-gavel"></i> <br />中间件
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/jiagou/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-rocket"></i> <br />架构
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/python/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-ship"></i> <br />python
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/front/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-bolt"></i> <br />前端
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/jvm/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-balance-scale"></i> <br />jvm
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/c/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-battery-empty"></i> <br />c语言
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/web3/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-web3"></i> <br />web3
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/post/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br />归档
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/about/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-user"></i> <br />关于
          </a>
        </li>
      
      <li class="menu-item menu-item-search">
        <a href="javascript:;" class="popup-trigger"> <i class="menu-item-icon fa fa-search fa-fw"></i> <br /> 搜索</a>
      </li>
    </ul>
    <div class="site-search">
      <div class="popup">
 <span class="search-icon fa fa-search"></span>
 <input type="text" id="local-search-input">
 <div id="local-search-result"></div>
 <span class="popup-btn-close">close</span>
</div>

    </div>
</nav>

 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            
<section id="posts" class="posts-expand">
  <article class="post post-type-normal " itemscope itemtype="http://schema.org/Article">
    <header class="post-header">
      <h1 class="post-title" itemprop="name headline">
        <a class="post-title-link" href="http://www.shutdown.cn/post/redis6.0%E6%96%B0%E7%89%B9%E6%80%A7-acls%E6%9D%83%E9%99%90%E6%8E%A7%E5%88%B6/" itemprop="url">
        
        </a>
      </h1>
      <div class="post-meta">
      <span class="post-time">
<span class="post-meta-item-icon">
    <i class="fa fa-calendar-o"></i>
</span>
<span class="post-meta-item-text">时间：</span>
<time itemprop="dateCreated" datetime="2016-03-22T13:04:35+08:00" content="0001-01-01">
    0001-01-01
</time>
</span> 
      
      
       <span>
&nbsp; | &nbsp;
<span class="post-meta-item-icon">
    <i class="fa fa-eye"></i>
</span>
<span class="post-meta-item-text">阅读：</span>
<span class="leancloud-visitors-count">814 字 ~4分钟</span>
</span>
      </div>
    </header>
    <div class="post-body" itemprop="articleBody">
    

    

<h2 id="acls-权限控制">ACLs 权限控制</h2>

<hr />

<p>  Redis 6开始支持ACL，该功能通过限制对命令和key的访问来提高安全性。ACL的工作方式是在连接之后，要求客户端进行身份验证（用户名和有效密码）；如果身份验证阶段成功，则连接与指定用户关联，并且该用户具有限制。
  在默认配置中，Redis 6的工作方式与Redis的旧版本完全相同，每个新连接都能够调用每个可能的命令并访问每个键，因此ACL功能与旧版本向后兼容。客户和应用程序。依旧使用requirepass配置密码的，但现在只是为默认用户设置密码。</p>

<h3 id="4-1-acl使用">4.1 ACL使用</h3>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback"> 1) ACL &lt;subcommand&gt; arg arg ... arg. Subcommands are:
 2) LOAD                             -- Reload users from the ACL file.
 3) SAVE                             -- Save the current config to the ACL file.
 4) LIST                             -- Show user details in config file format.
 5) USERS                            -- List all the registered usernames.
 6) SETUSER &lt;username&gt; [attribs ...] -- Create or modify a user.
 7) GETUSER &lt;username&gt;               -- Get the user details.
 8) DELUSER &lt;username&gt; [...]         -- Delete a list of users.
 9) CAT                              -- List available categories.
10) CAT &lt;category&gt;                   -- List commands inside category.
11) GENPASS [&lt;bits&gt;]                 -- Generate a secure user password.
12) WHOAMI                           -- Return the current connection username.
13) LOG [&lt;count&gt; | RESET]            -- Show the ACL log entries.</code></pre></div>
<p>  Redis6中auth命令在Redis 6中进行了扩展，因此现在可以在两个参数的形式中使用它：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">  #before Redis 6
  AUTH &lt;password&gt;
  #Redis 6
  AUTH &lt;username&gt; &lt;password&gt;</code></pre></div>
<p>  默认情况下，有一个用户定义，称为<code>default</code>。可以使用ACL LIST命令来查看，默认配置的Redis实例的配置是：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">#无密码
127.0.0.1:6379&gt; ACL LIST
1) &#34;user default on nopass ~* +@all&#34;
#有密码
127.0.0.1:6379&gt; ACL LIST
1) &#34;user default on #ce306e0ee195cc817620c86d7b74126d0d66c077b66f66c10f1728cf34a214d3
127.0.0.1:6379&gt; ACL WHOAMI
&#34;default&#34;
127.0.0.1:6379&gt; ACL USERS
1) &#34;default&#34;</code></pre></div>
<p>  每行的开头都是“ user”，后面跟用户名，<code>on</code>表示用户是启用的，否则是禁用的。<code>nopass</code>表示无密码，否则表示有密码认证。（<code>~*</code>）表示能够访问所有的key，<code>+ @ all</code>表示能够调用所有可能的命令。</p>

<h3 id="4-2-acl规则">4.2 ACL规则</h3>

<p><strong>启用和禁止用户</strong></p>

<ul>
<li><code>on</code>：启用用户：可以以该用户身份进行认证。</li>
<li><code>off</code>：禁用用户：不再可以与此用户进行身份验证，但是已经过身份验证的连接仍然可以使用。如果默认用户标记为off，则无论默认用户配置如何，新连接都将开始不进行身份验证，并且要求用户使用AUTH选项发送AUTH以进行身份验证。</li>
</ul>

<p><strong>允许和禁止命令</strong></p>

<ul>
<li><code>+&lt;command&gt;</code>：将命令添加到用户可以调用的命令列表中。</li>
<li><code>-&lt;command&gt;</code>：将命令从用户可以调用的命令列表中删除。</li>

<li><p><code>+@&lt;category&gt;</code>：添加该类别中要由用户调用的所有命令，有效类别为@ admin，@ set，@ sortedset等，通过调用ACL CAT命令查看完整列表。特殊类别@all表示所有命令，包括当前在服务器中存在的命令，以及将来将通过模块加载的命令。</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">127.0.0.1:6379&gt; ACL CAT
1) &#34;keyspace&#34;
2) &#34;read&#34;
3) &#34;write&#34;
4) &#34;set&#34;
5) &#34;sortedset&#34;
6) &#34;list&#34;
7) &#34;hash&#34;
8) &#34;string&#34;
9) &#34;bitmap&#34;
10) &#34;hyperloglog&#34;
11) &#34;geo&#34;
12) &#34;stream&#34;
13) &#34;pubsub&#34;
14) &#34;admin&#34;
15) &#34;fast&#34;
16) &#34;slow&#34;
17) &#34;blocking&#34;
18) &#34;dangerous&#34;
19) &#34;connection&#34;
20) &#34;transaction&#34;
21) &#34;scripting&#34;</code></pre></div></li>

<li><p><code>-@&lt;category&gt;</code>：从客户端可以调用的命令列表中删除命令。</p></li>

<li><p><code>+&lt;command&gt;|subcommand</code>：允许使用本来禁用的命令的特定子命令。该语法不允许使用<code>-&lt;command&gt;|subcommand</code>，例如<code>-DEBUG|SEGFAULT</code>，只能以“ +”开头的加法运算符。如果命令整体上已处于活动状态，则此ACL将导致错误。</p></li>

<li><p><code>allcommands</code>：<code>+ @ all</code>的别名。</p></li>

<li><p><code>nocommands</code>：<code>-@ all</code>的别名。</p></li>
</ul>

<p><strong>允许或禁止访问某些Key</strong></p>

<ul>
<li>~：添加可以在命令中提及的键模式。例如~<em>和</em> allkeys 允许所有键。

<ul>
<li>resetkeys：使用当前模式覆盖所有允许的模式。如： ~foo: <em>~bar:</em> resetkeys ~objects: <em>，客户端只能访问匹配 object:</em> 模式的 KEY。</li>
</ul></li>
</ul>

<p><strong>为用户配置有效密码</strong></p>

<ul>
<li>：将此密码添加到用户的有效密码列表中。例如，&gt;mypass将“mypass”添加到有效密码列表中。该命令会清除用户的nopass标记。每个用户可以有任意数量的有效密码。</li>
<li>&lt;：从有效密码列表中删除此密码。若该用户的有效密码列表中没有此密码则会返回错误信息。</li>
<li>：将此SHA-256哈希值添加到用户的有效密码列表中。该哈希值将与为ACL用户输入的密码的哈希值进行比较。允许用户将哈希存储在users.acl文件中，而不是存储明文密码。仅接受SHA-256哈希值，因为密码哈希必须为64个字符且小写的十六进制字符。</li>
<li>!：从有效密码列表中删除该哈希值。当不知道哈希值对应的明文是什么时很有用。</li>
<li>nopass：移除该用户已设置的所有密码，并将该用户标记为nopass无密码状态：任何密码都可以登录。resetpass命令可以清除nopass这种状态。</li>
<li>resetpass：情况该用户的所有密码列表。而且移除nopass状态。resetpass之后用户没有关联的密码同时也无法使用无密码登录，因此resetpass之后必须添加密码或改为nopass状态才能正常登录。</li>
<li>reset：重置用户状态为初始状态。执行以下操作resetpass，resetkeys，off，-@all。</li>
</ul>

<h3 id="4-3-创建和编辑用户">4.3 创建和编辑用户</h3>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">127.0.0.1:6379&gt; ACL SETUSER zijie
OK
`SETUSER`命令采用用户名和ACL规则列表以应用于用户。但是在上面的示例中，没有指定任何规则。如果用户不存在，这将使用默认属性来创建用户。如果用户已经存在，则上面的命令将不执行任何操作。
默认的用户状态：
127.0.0.1:6379&gt; acl list
1) &#34;user default on #ce306e0ee195cc817620c86d7b74126d0d66c077b66f66c10f1728cf34a214d3 ~* +@all&#34;
2) &#34;user zijie off -@all&#34;   </code></pre></div>
<p>刚创建的用户<code>zijie</code>是：</p>

<ul>
<li><p>处于禁用状态，AUTH不起作用。</p></li>

<li><p>无法访问任何命令。</p></li>

<li><p>无法访问任何key。</p></li>

<li><p>没有设置密码。</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">127.0.0.1:6379&gt; ACL SETUSER zijie2 on &gt;123 ~* +get
OK
127.0.0.1:6379&gt; acl list
1) &#34;user default on #ce306e0ee195cc817620c86d7b74126d0d66c077b66f66c10f1728cf34a214d3 ~* +@all&#34;
2) &#34;user zijie off -@all&#34;
3) &#34;user zijie2 on #a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3 ~cached:* -@all +get&#34;
127.0.0.1:6379&gt; ACL SAVE
OK</code></pre></div></li>
</ul>

<p>  用户可以执行某些操作，但是会拒绝执行其他操作，权限动态生效：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">127.0.0.1:6379&gt; auth zijie2 123
OK
127.0.0.1:6379&gt; get name
&#34;zijie&#34;
127.0.0.1:6379&gt; set name:2 a
(error) NOPERM this user has no permissions to run the &#39;set&#39; command or its subcommand
#ACL LIST 查看用户配置
127.0.0.1:6379&gt; ACL LIST
1) &#34;user default on #ce306e0ee195cc817620c86d7b74126d0d66c077b66f66c10f1728cf34a214d3 ~* +@all&#34;
2) &#34;user zijie off -@all&#34;
3) &#34;user zijie2 on #a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3 ~* -@all +get&#34;
#用户名区分大小写，ACL GETUSER 易读性高于ACL LIST
127.0.0.1:6379&gt; ACL GETUSER zijie2
1) &#34;flags&#34;
2) 1) &#34;on&#34;
2) &#34;allkeys&#34;
3) &#34;passwords&#34;
4) 1) &#34;a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3&#34;
5) &#34;commands&#34;
6) &#34;-@all +get&#34;
7) &#34;keys&#34;
8) 1) &#34;*&#34;
#使用RESP3易读性更高
127.0.0.1:6379&gt; ACL GETUSER zijie2
1# &#34;flags&#34; =&gt; 1~ &#34;on&#34;
2~ &#34;allkeys&#34;
2# &#34;passwords&#34; =&gt; 1) &#34;a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3&#34;
3# &#34;commands&#34; =&gt; &#34;-@all +get&#34;
4# &#34;keys&#34; =&gt; 1) &#34;*&#34;</code></pre></div>
<p>  使用另一个ACL SETUSER命令向用户添加多个模式：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">127.0.0.1:6379&gt; ACL SETUSER zijie3 on &gt;123 ~zijie* +get
OK
127.0.0.1:6379&gt; ACL SETUSER zijie3 on &gt;123 ~zijie* +set
OK
127.0.0.1:6379&gt; ACL SETUSER zijie3 on &gt;123 ~zijie* +@read
OK
127.0.0.1:6379&gt; ACL LIST
1) &#34;user default on #ce306e0ee195cc817620c86d7b74126d0d66c077b66f66c10f1728cf34a214d3 ~* +@all&#34;
2) &#34;user zijie off -@all&#34;
3) &#34;user zijie2 on #a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3 ~* -@all +get&#34;
4) &#34;user zijie3 on #a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3 ~zijie* ~name* ~xx* -@all +@read +@hash +@bitmap +@geo -bitfield -hmset +set -geoadd -hincrby -hset -hincrbyfloat -georadiusbymember -hdel -hsetnx -bitop -georadius -setbit&#34;
#删除用户
ACL DELUSER zijie3</code></pre></div>
<h3 id="4-4-命令类别">4.4 命令类别</h3>

<p>  ACL有类似&rdquo;资源组“的概念，给一类命令一个别名，来达到快速授权。</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">127.0.0.1:6379&gt; acl cat
 1) &#34;keyspace&#34;
 2) &#34;read&#34;
 3) &#34;write&#34;
 4) &#34;set&#34;
 5) &#34;sortedset&#34;
 6) &#34;list&#34;
 7) &#34;hash&#34;
 8) &#34;string&#34;
 9) &#34;bitmap&#34;
10) &#34;hyperloglog&#34;
11) &#34;geo&#34;
12) &#34;stream&#34;
13) &#34;pubsub&#34;
14) &#34;admin&#34;
15) &#34;fast&#34;
16) &#34;slow&#34;
17) &#34;blocking&#34;
18) &#34;dangerous&#34;
19) &#34;connection&#34;
20) &#34;transaction&#34;
21) &#34;scripting&#34;
127.0.0.1:6379&gt; acl cat dangerous
 1) &#34;flushdb&#34;
 2) &#34;sort&#34;
 3) &#34;swapdb&#34;
 4) &#34;replicaof&#34;
 5) &#34;shutdown&#34;
 6) &#34;replconf&#34;
 7) &#34;keys&#34;
 8) &#34;lastsave&#34;
 9) &#34;psync&#34;
10) &#34;cluster&#34;
11) &#34;module&#34;
12) &#34;acl&#34;
13) &#34;bgrewriteaof&#34;
14) &#34;info&#34;
15) &#34;debug&#34;
16) &#34;bgsave&#34;
17) &#34;sync&#34;
18) &#34;flushall&#34;
19) &#34;save&#34;
20) &#34;pfdebug&#34;
21) &#34;latency&#34;
22) &#34;role&#34;
23) &#34;slaveof&#34;
24) &#34;migrate&#34;
25) &#34;pfselftest&#34;
26) &#34;config&#34;
27) &#34;monitor&#34;
28) &#34;restore&#34;
29) &#34;slowlog&#34;
30) &#34;restore-asking&#34;
31) &#34;client&#34;
127.0.0.1:6379&gt; ACL SETUSER zijie4 on +@all -@dangerous &gt;123 ~*
OK
127.0.0.1:6379&gt; ACL GETUSER zijie4
1) &#34;flags&#34;
2) 1) &#34;on&#34;
2) &#34;allkeys&#34;
3) &#34;passwords&#34;
4) 1) &#34;a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3&#34;
5) &#34;commands&#34;
6) &#34;+@all -@admin -@dangerous&#34;
7) &#34;keys&#34;
8) 1) &#34;*&#34;</code></pre></div>
<p><strong>授权子命令</strong></p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">ACL SETUSER zijie5 -client +client|setname +client|getname </code></pre></div>
<h3 id="4-5-使用外部acl文件">4.5 使用外部ACL文件</h3>

<p>  Redis6因为引入了权限机制，会有不同分工的用户；所以又引入了额外的配置项以及配置文件，通过ACL LOAD/ACL SAVE报错和加载acl文件。</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">[root@zijie ~]# cat /etc/Redis6.conf  | grep acl
aclfile /usr/local/Redis/users.acl
acllog-max-len 128
#Redis6开始密码加密存储
[root@zijie ~]# cat /usr/local/Redis/users.acl
user default on #ce306e0ee195cc817620c86d7b74126d0d66c077b66f66c10f1728cf34a214d3 ~* +@all
user zijie off -@all
user zijie2 on #a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3 ~* -@all +get
user zijie3 off ~zijie* ~name* -@all
#获取安全密码
127.0.0.1:6379&gt; ACL GENPASS
&#34;c550b646ef8f7f91908628db0d983b4ca061fcf36433baa770ea9ce09da64ef4&#34;</code></pre></div>
<h3 id="4-6-哨兵和副本的acl规则">4.6 哨兵和副本的ACL规则</h3>

<p>  如果不想为Redis副本和Redis Sentinel实例提供对Redis实例的完全访问权限，则以下是一组命令，为了使一切正常工作，必须允许这些命令。
  对于Sentinel，允许用户在主实例和副本实例中访问以下命令：
  Sentinel不需要访问数据库中的任何密钥，因此ACL规则如下（注意：不需要AUTH，因为始终允许使用AUTH）：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">ACL setuser sentinel-user &gt;somepassword +client +subscribe +publish +ping +info +multi +slaveof +config +client +exec on</code></pre></div>
<p>  Redis副本需要在主实例上将以下命令列入白名单：</p>

<ul>
<li>PSYNC，REPLCONF，PING</li>
</ul>

<p>  不需要访问任何密钥，因此这转化为以下规则：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">ACL setuser replica-user &gt;somepassword +psync +replconf +ping on</code></pre></div>
<p>  无需将副本配置为允许主服务器能够执行任何命令集：从副本的角度来看，主服务器始终被认证为root用户。</p>

<h3 id="4-7-acl-log">4.7 ACL LOG</h3>

<p>  记录拒绝的命令，密钥访问和身份验证。</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">127.0.0.1:6379&gt; acl log
 1)  1) &#34;count&#34;
     2) (integer) 1
     3) &#34;reason&#34;
     4) &#34;auth&#34;
     5) &#34;context&#34;
     6) &#34;toplevel&#34;
     7) &#34;object&#34;
     8) &#34;auth&#34;
     9) &#34;username&#34;
    10) &#34;default&#34;
    11) &#34;age-seconds&#34;
    12) &#34;7.3860000000000001&#34;
    13) &#34;client-info&#34;
    14) &#34;id=18 addr=127.0.0.1:51882 fd=8 name= age=2 idle=0 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=26 qbuf-free=32742 obl=0 oll=0 omem=0 events=r cmd=auth user=default&#34;</code></pre></div>
    </div>
    <footer class="post-footer">
     

     <div class="post-nav">
    <div class="post-nav-next post-nav-item">
    
        <a href="http://www.shutdown.cn/post/redis6.0-tls%E6%B5%8B%E8%AF%95/" rel="next" title="">
        <i class="fa fa-chevron-left"></i> 
        </a>
    
    </div>

    <div class="post-nav-prev post-nav-item">
    
        <a href="http://www.shutdown.cn/post/redis6.0%E6%96%B0%E7%89%B9%E6%80%A7-acl%E6%9D%83%E9%99%90%E6%8E%A7%E5%88%B6%E5%85%B6%E4%B8%80/" rel="prev" title="">
         <i class="fa fa-chevron-right"></i>
        </a>
    
    </div>
</div>
      
     
     
     






    </footer>
  </article>
</section>

          </div>
        </div>
        <div class="sidebar-toggle">
  <div class="sidebar-toggle-line-wrap">
    <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
    <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
    <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
  </div>
</div>
<aside id="sidebar" class="sidebar">
  <div class="sidebar-inner">

    <section class="site-overview sidebar-panel  sidebar-panel-active ">
      <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image"
        src="http://www.shutdown.cn/img/author.jpg"
        alt="不与天斗Domino" />
    <p class="site-author-name" itemprop="name">不与天斗Domino</p>
    <p class="site-description motion-element" itemprop="description"> 
        Programmer &amp; Architect</p>
</div>
      <nav class="site-state motion-element">
    <div class="site-state-item site-state-posts">
      <a href="http://www.shutdown.cn/post/">
        <span class="site-state-item-count">183</span>
        <span class="site-state-item-name">日志</span>
      </a>
    </div>
    <div class="site-state-item site-state-categories">    
        <a href="http://www.shutdown.cn/categories/">      
         
        <span class="site-state-item-count">15</span>
        
        <span class="site-state-item-name">分类</span>
        
        </a>
    </div>

    <div class="site-state-item site-state-tags">
        <a href="http://www.shutdown.cn/tags/">
         
        <span class="site-state-item-count">224</span>
        
        <span class="site-state-item-name">标签</span>
        </a>
    </div>
</nav>
      
      

      

      <div class="links-of-blogroll motion-element inline">
<script type="text/javascript" src="//rf.revolvermaps.com/0/0/8.js?i=&amp;m=0&amp;s=220&amp;c=ff0000&amp;cr1=ffffff&amp;f=arial&amp;l=33&amp;bv=35" async="async"></script>
</div>

    </section>
    
  </div>
</aside>

      </div>
    </main>
   
    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright" >
  <span itemprop="copyrightYear">  &copy; 
  2013 - 2023</span>
  <span class="with-love"><i class="fa fa-heart"></i></span>
  <span class="author" itemprop="copyrightHolder">天地维杰网</span>
  <span class="icp" itemprop="copyrightHolder"><a href="https://beian.miit.gov.cn/" target="_blank">京ICP备13019191号-1</a></span>
</div>
<div class="powered-by">
  Powered by - <a class="theme-link" href="http://gohugo.io" target="_blank" title="hugo" >Hugo v0.63.2</a>
</div>
<div class="theme-info">
  Theme by - <a class="theme-link" href="https://github.com/xtfly/hugo-theme-next" target="_blank"> NexT
  </a>
</div>


      </div>
    </footer>

    <div class="back-to-top">
      <i class="fa fa-arrow-up"></i>
      <span id="scrollpercent"><span>0</span>%</span>
    </div>
  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/jquery/index.js?v=2.1.3"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/fastclick/lib/fastclick.min.js?v=1.0.6"></script> 
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/velocity/velocity.min.js?v=1.2.1"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/velocity/velocity.ui.min.js?v=1.2.1"></script>
<script src="http://www.shutdown.cn/js/vendor/ua-parser-js/dist/ua-parser.min.js?v=0.7.9"></script>

<script src="http://www.shutdown.cn/js/vendor/fancybox/jquery.fancybox.pack.js?v=2.1.5"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/utils.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/motion.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/affix.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/schemes/pisces.js"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/scrollspy.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/post-details.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/toc.js"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/bootstrap.js"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/search.js"></script>
<script type="text/x-mathjax-config">
  MathJax.Hub.Config({
    extensions: ["tex2jax.js"],
    jax: ["input/TeX", "output/HTML-CSS"],
    tex2jax: {
      inlineMath: [ ['$','$'] ],
      displayMath: [ ['$$','$$'] ],
      processEscapes: true
    },
    "HTML-CSS": { fonts: ["TeX"] }
  });
</script>
<script src='https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js?config=TeX-AMS-MML_HTMLorMML' async></script>
</body>
</html>